CVE and CVSS

The CVE Program was launched by MITRE in 1999 and is funded by the US government through CISA. IDs are assigned in a federated way by CVE Numbering Authorities (CNAs), mostly vendors, CERTs and bug-bounty platforms, each with a defined scope and organised under Root CNAs. The ID syntax is CVE-YYYY-NNNN, where the year is the year the ID was assigned or the flaw made public, not the year it was discovered, and since 2014 the sequence part may have any number of digits from four upwards. A record is published in the CVE JSON 5 format and can be RESERVED, PUBLISHED or REJECTED; a CVE says only that a distinct flaw exists, with a description and affected versions, not how dangerous it is.

CVSS is maintained separately by FIRST. In v3.1 the base score is computed from eight metrics: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, and the Confidentiality, Integrity and Availability impacts; qualitative bands are None 0.0, Low 0.1-3.9, Medium 4.0-6.9, High 7.0-8.9 and Critical 9.0-10.0. CVSS v4.0, published in November 2023, drops Scope in favour of separate impact metrics for the vulnerable system and subsequent systems, adds Attack Requirements, splits User Interaction into Passive and Active, and introduces the nomenclature CVSS-B, CVSS-BT, CVSS-BE or CVSS-BTE depending on which of the Base, Threat and Environmental groups were used. Log4Shell, CVE-2021-44228, scored 10.0 under v3.1.

The most common misconception is that CVSS measures risk. FIRST itself states it measures technical severity; most published scores are base-only and ignore whether exploitation is happening and how exposed the asset is. That is why prioritisation now combines CVSS with EPSS, FIRST's model estimating the probability of exploitation within the next 30 days, and with CISA's Known Exploited Vulnerabilities catalogue, which has driven binding remediation deadlines for US federal agencies since BOD 22-01 in 2021. Different sources also score the same CVE differently: the vendor CNA, NVD and a scanner may disagree.

The ecosystem has had structural strain. From early 2024 the US National Vulnerability Database built a large backlog of records awaiting enrichment (CPE product data and NVD scores), and in April 2025 the MITRE contract nearly lapsed before CISA extended it; funding was later put on a more durable footing. NIS2 Art. 12(2) required ENISA to build a European vulnerability database, and the EUVD went live in May 2025 with its own EUVD identifiers that cross-reference CVE IDs rather than replace them; ENISA is also a CNA. A CVE is not a prerequisite for a vulnerability: many flaws, especially in internal software or misconfigurations, never receive one.